topic Re: Setting IncidentName and IncidentSeverity with Incoming Mapper in Cortex XSOAR Discussions

Setting IncidentName and IncidentSeverity with Incoming Mapper

ArthurCircus — Wed, 25 Jan 2023 09:33:39 GMT

Hello,

I am trying to set the IncidentName and IncidentSeverity of an XSoar incident with the incoming mapper but it does not work. Ive tried googling and reading up but I cant find how you are supposed to set these fields.

Has anyone done this before and can point me to the right documentation to follow?

Thanks!

Re: Setting IncidentName and IncidentSeverity with Incoming Mapper

chrking — Thu, 26 Jan 2023 04:43:53 GMT

I've set the incident name before with a mapper - the field is just called "name" and it works as expected. I'd double check you're using the right fields and that the data format you're trying to set is correct. Also, I'd check that the incident type selector at the top of the mapping editor is set either to the correct incident type or "Common Mapping" when you configure the name/severity mappings.

Re: Setting IncidentName and IncidentSeverity with Incoming Mapper

ArthurCircus — Thu, 26 Jan 2023 08:24:47 GMT

Yeah, I realized I had gotten the wrong source document that I based my mapping on.. Thank you for your reply!